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means for sensing one or more environmental and/or 
vehicle associated parameter values, processing 
means fed by the sensor means and including data and 
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program storage facilities, presentation means fed by 
the processing means for presentating various multime- 
dia-based outputs to an operator, and actuator signal 
output means fed by the processing means for output- 
ting one or more actuator control signals for controlling 
one or more associated safety-related devices. 
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Description 

[0001 ] A motor vehicle multimedia and telematic sys- 
tem including a navigation system with a main processor 
for multimedia and navigation calculations and for first 
security-critical calculations result data and a secondary 
processor for second security -critical calculations, 
wherein the processing outputs security-critical result 
data after validation among said first and second secu- 
rity-critical calculations 

[0002] The invention relates to a multimedia and 
telematic system Including a navigation system for a 
motor vehicle and comprising sensor means for sensing 
one or more environmental and/or vehicle-associated 
parameter values, processing means fed by said sensor 
means and including data and program storage facili- 
ties, presentation means fed by said processing means 
for presenting various multimedia-based results to an 
operator, and actuator signal output means fed by said 
processing means for outputting one or more actuator 
control signals for controlling one or more associated 
safety-related devices. The sensed or derived parame- 
ter values may include such items as air and road tem- 
perature, air humidity, vehicle speed, vehicle accelera- 
tion, vehicle position and orientation, vehicle seat ad- 
justment, safety belt fixation, and others. Present-day 
vehicle control systems are using such and other pa- 
rameter values for various purposes, such as for con- 
trolled braking, airbag activating, generating warning 
signals, and other that are generally related to safety of 
driver and/or vehicle. A state-of-the-art system for exe- 
cuting such security-related measures has been dis- 
closed in European Patent Application 0 663 324 A1 . 
[0003] Furthermore, the generally increasing usage 
of digital technology in vehicles has also led to introduc- 
ing various multimedia based interfacings to an operator 
or user, such as the displaying of maps in the ambit of 
a vehicle navigation system, the generating of advice 
items regarding points-of-lnterest, messages regarding 
traffic conditions, weather forecasts, e-mailing, the gen- 
erating of speech output and/or recognizing operator 
speech, and various other applications. The present in- 
ventor has recognized the great computational and 
communication workload imposed by such multi-media 
applications on the generally "main" data processing fa- 
cilities that are present in such vehicle, but which nev- 
ertheless have a quite restricted processing power. In 
particular, the technical security of such multimedia 
processing operations is often less than perfect, both in 
terms of hardware and in terms of software. Various er- 
rors couid occur, such as through atmospheric interfer- 
ence on external connections, Internal communication 
bus collisions, memory or processing faults, software 
bugs and various others. The temporal duration of such 
errors or faults can vary enormously from transient er- 
rors in the microsecond region to such that can persist 
for an undefined long time. In practical use, most of the 
errors so generated viz A viz the multimedia interfacing 



would hardly be felt by the operator. Even if otherwise, 
time-consuming countermeasures, such as a correc- 
tional repeat of the operation in question would gener- 
ally not represent a problem. 

5 [0004] On the other hand, in the case of using the 
processing operations for the above safety-related fa- 
cilities, the occurrence of an error could lead to serious, 
and sometimes even dangerous, consequences. Nev- 
ertheless, the usage of the above "main" processing 

10 hardware and software will generally present a great ad- 
vantage. In fact, most of the time, the overall safety of 
driver/passenger(s) and vehicle will not represent a 
problem whatsoever. Furthermore, the power of the 
main processor facility wilt allow for fast repetition of 

15 these safety- related calculations, and/or getting the out- 
put result with high-quality resolution. Effectively, the 
present inventor has therefore recognized the need for 
a "second line of defence" that would on relatively short 
notice signal such processing errors that could have an 

20 impact on the safety-related operations and take correc- 
tional action as quickly as possible, but that would leave 
the multimedia-related operations alone. 
[0005] In consequence, amongst other things, it is an 
object of the present invention to provide the main data 

25 processing facilities with a secondary data processing 
facility that generally restricts to executing less data- 
processing intensive tasks, and In particular, safety-re- 
lated data processing tasks, and to signal on appropri- 
ately short notice any sizeable discrepancy between the 

30 two data processing subsystems. 

[0006] Now therefore, according to one of Us aspects 
the invention is characterized in that said processing 
means comprise a main processor unit for executing 
multimedia and navigation calculations and furthermore 

35 first security- related calculations, and said system com- 
prises furthermore a secondary processor unit for exe- 
cuting second security-related calculations, wherein 
said main processor unit has a first output for outputting 
multi-media result data and a second output for output- 

40 ting first security-related result data and in that the sec- 
ondary processor has a third output for outputting sec- 
ond security-related result data, wherein said process- 
ing means furthermore comprise validation means fed 
by said first and second critical result data for on the 

45 basis thereof selectively enabling a further output for 
outputting results based on said first security- related 
calculations. In consequence, the processing in the sec- 
ond processor unit would not by itself allow executing 
all security-related calculations, but only a selection 

50 thereof. Thereupon, some measure of comparing with 
the security-related calculations in the main processor 
unit would indicate the correct nature of the latter calcu- 
lations or otherwise. 

[0007] A preferred embodiment of a multimedia and 
55 telematic system including a navigation system accord- 
ing to the invention is characterized In that said main 
and secondary processor units receive identical sets of 
sensor signals. 
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[0008] Alternative preferred embodiments of a multi- 
media and telematlc system according to the invention 
are characterized in that said main and secondary proc- 
essor units receive mutually exclusive sets of sensor 
signals or are sharing a subset of the overall set of sen- 
sor signals. 

[0009] According to another aspect of the invention, 
said secondary processor unit recurrently calculates at 
least one critical security datum of a current speed and 
a current position of said motor vehicle. 
[0010] Such multimedia and telematic system may 
preferably be characterized In that said secondary proc- 
essor unit calculates a particular critical security- related 
datum at a greater re-currency spacing than does said 
main processor unit, or alternatively in that said second- 
ary processor unit calculates a particular critical securi- 
ty-related datum at a lower resolution than does said 
main processor unit. 

[0011] According to yet another aspect of the inven- 
tion, said multimedia and telematic system is preferably 
characterized by effecting short-term validation at a dif- 
ferent tolerance value from long term validation. 
[0012] To prevent jittered non-validation from occur- 
ring, a preferred embodiment of the above multimedia 
and telematic system according to the invention is char- 
acterized by a hysteresis facility. 
[001 3] The invention also relates to a navigation sys- 
tem for use in a multimedia and telematic system as well 
as to a motor vehicle arranged with such a navigation 
system or with a multimedia and telematic system as 
claimed in Claim 1 . 

[0014] These and further aspects and advantages of 
the invention will be discussed more in detail hereinafter 
with reference to the disclosure of preferred embodi- 
ments, and in particular with reference to the appended 
Figures that show: 

Figure 1 , a succinct diagram of the overall 

processing schedule of a multimedia 
and telematic system including a 
navigation system according to the 
Invention; 

Figure 2. a diagram of the filtering arrange- 

ment for use in the multimedia and 
telematic system referred to in Fig- 
ure 1; 

Figure 3, a first assignment schedule of sen- 

sor data; 

Figure 4, a second assignment schedule of 

sensor data; 

Figure 5, a third assignment schedule of sen- 

sor data; 

Figure 6, a motor vehicle provided with a mul- 

timedia and telematic system ac- 
cording to the present invention; 

Figures 7a, 7b, two functional arrangements regard- 
ing the signal validation. 
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[0015] Figure 1 illustrates a succinct diagram of the 
overall processing schedule regarding the security-re- 
lated calculations applied in a multimedia and telematic 
system according to the invention. The input sensor sig- 

5 nals are represented by block 50. From these, in block 
52, the main or multimedia (MMN) processor will calcu- 
late the actual vehicle position P1 . Likewise, in block 54, 
the secondary or security processor will calculate the 
actual vehicle position P2. Next, the two actual positions 

10 P1 , P2, will be checked for correspondence or non-cor- 
respondence. This will be explained more in detail with 
reference to figure 2 hereinafter. If correspondence, P1 
= P2, in block 56, the security processor will execute a 
filtering operation on ( P1 • P2 ). If the outcome of the 

15 filtering is positive, in block 56, the necessary control 
signals for the appropriate vehicle operation will be out- 
putted. If block 54 finds non -correspondence between 
P1 and P2 ( in block 58 the security processor will again 
execute the filtering operation. Eventually, the outcome 

20 of the filtering may or may not signal that the main proc- 
essor is malfunctioning. 

[0016] Figure 2 illustrates a diagram of the filtering ar- 
rangement, of which the overall situating has been dis- 
cussed with reference to Figure 1. 

25 First, in block 60, the difference between the absolute 
values of P1 and P2 is calculated. Note that the output 
results P1 , P2 from the processing can be signed quan- 
tities. Next, the difference between the absolute values 
of P1 and P2 is compared with a threshold k1, and a 

30 first tri-valent output quantity Out2 is produced. 

Next, in block 62 a temporal sequence of values for the 
quantity Out2 is summed, in this case for eleven suc- 
cessive instants, to so produce the quantity Out2(n). 
which should then lie in the interval [ -11 , +1 1 J. 

35 Next, the resulting value for Out1(n) Is compared to a 
threshold K, and a final binary Out(n) is generated ac- 
cording to the expression In ellipse 64. Here of course, 
the absolute value of the summed differences Outl(n) 
is used. For the values of k1 and K, appropriate quan- 
go titles should betaken that can be derived by experiment. 
[0017] The various thresholds could include a hyster- 
esis, in that excess of the threshold should either in time, 
or in extent represent an anti-jitter barrier, whereas also 
the termination of such excess should represent a cer- 

4* tain interval, or a sub-threshold amount, respectively. Al- 
so, if more than one result category is used for the val- 
idating, the above intervals should consider the degree 
of danger that a discrepancy would represent. For ex- 
ample, for anti-collision or braking control the interval 

50 should be brief, such a small fraction of a second. On 
the other hand, regarding to the signalling that the vehi- 
cle driver should change lanes or make some other ma- 
noeuvre, the interval may be appreciably longer, such 
as a few seconds. Finally, the momentary threshold val- 

55 ue may differ from a threshold value related to a time 
average. 

[0018] Instead of the vehicle positions P1 , P2, other 
sensed or derived parameter values could be used, 
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such as the vehicle speed. Furthermore, the main proc- 
essor unit 28 and the security processor unit 30 need 
not to process a complete Identical set of security-re- 
lated parameters, provided that the parameter values 
considered for the validation, should in fact be the same. 
Also for calculating a particular parameter vale, the main 
and security processor units should not by necessity use 
the same algorithms, or should even use the same 
measurement values for those same parameters. 
[0019] Figure 3 illustrates a first assignment schedule 
of sensor data, In this schedule, both main processor 
unit 28 for multimedia and navigation calculations, and 
also secondary processor 30 for critical security calcu- 
lations receive identical sets of sensor signals, to wit, 
from GPS-based position sensor 20, Gyro-based direc- 
tional sensor 22, and Odometer-based speed sensor 
24. Output 32 for non-security-critical result data ema- 
nates directly from main processor 28. Output 36 for se- 
curity-critical result data feeds secondary processor 30. 
Output 34 for security -critical result data emanates from 
secondary processor 30 for presentation thereof to fur- 
ther subsystems not shown for brevity, 
[0020] Figure 4 illustrates a second assignment 
schedule of sensor data. Here, main processor unit 28 
for multimedia and navigation calculations, and second- 
ary processor 30 for critical security calculations receive 
separate sets of sensor signals, the main processor re- 
ceiving signals from GPS-based position sensor 20, 
Gyro-based directional sensor 22, and Odometer- 
based speed sensor 24, and the secondary processor 
30 receiving signals from wheel-road sensor 26. The 
output from main processor 28 has been labelled 38 in 
that the composition of the signals thereon can differ 
from that on line 36 in Figure 3. 
[0021] Figure 5 illustrates a third assignment sched- 
ule of sensor data. Here, main processor unit 28 for mul- 
timedia and navigation calculations, and secondary 
processor 30 for critical security calculations receive 
mixed sets of sensor signals, the main processor receiv- 
ing signals from GPS-based position sensor 20, Gyro- 
based directional sensor 22, and Odometer-based 
speed sensor 24, and the secondary processor 30 re- 
ceiving signals from GPS-based position sensor 20 as 
well as from wheel-road sensor 26. The output from 
main processor 28 has been labelled 40 in that the com- 
position of the signals thereon can differ from that on 
lines 36, 38 in Figures 3 and 4. 
[0022] Figure 6 illustrates a motor vehicle provided 
with a navigation system of the present invention. For 
brevity, the vehicle proper has been represented in a 
schematic manner only, through its overall body 70, and 
its front and rear wheels 72, 74. 
[0023] Furthermore, the vehicle data processing facil- 
ities include the following. Main processing system has 
processor unit 76, program storage 78, data storage 80, 
communication bus 82, and I/O control unit 90. This 
processing system executes vehicle navigation through 
receiving GPS data on aerial 92, for producing actual 



vehicle position and speed, and furthermore calculates 
the display frames that should be displayed on display 
unit 98. For brevity, other multimedia applications have 
not been shown, but could include speech channels, 
5 cameras, and various DVD- and CD-based applica- 
tions. 

[0024] Apart therefrom, the main processing system 
calculates various parameter values that are critical for 
various security related vehicle subsystems, such as re- 
10 garding airbag activation, automatic brake system, safe- 
ty belt checking and safe-belt tightening under certain 
emergency conditions such as high acceleration, and 
other; for brevity, such functions have not been shown 
in detail. 

is [0025] Furthermore, secondary processing system 
has processor unit 84, program storage 86, data storage 
88, communication bus 91 . and I/O control unit 94. This 
processing unit has generally appreciably less comput- 
ing power than the main system, but is nevertheless 

20 able to calculate certain security-related data, be it at a 
lower resolution and/or at longer time intervals and/or 
only a selection thereof. The choice of this resolution 
and temporal spacing could be open to the system de- 
signer. The security-related data could themselves re- 

2B late to an emergency, such as an excess acceleration, 
or the data could by themselves not relate to a critical 
situation, but only in relation to other data. For example 
an excess acceleration could only in relation with a high 
speed lead to airbag activation. Furthermore, the sys- 

30 tern comprises various sensors S1 1 00 and S2 1 02 that 
could sense certain relevant parameters for being proc- 
essed, as has been discussed supra. 
[0026] The sensor related data are forwarded to the 
communication interface 90 of main processor unit 76, 

35 through communication interface 90 and internal bus 
82. 

[0027] Furthermore, the same information, or a frac- 
tion thereof is forwarded to interface 94 and communi- 
cation bus 91 to processing unit 84. The safety- related 

40 parameter values are calculated in both processing 
units 76 and 84, and the ultimate values are compared 
In a communication interface unit 90, not further dis- 
cussed for brevity. If corresponding, these will control 
communication unit 90 to transmit the various control 

45 values via line 1 04 to peripheral control unit 96 that will 
actuate such control values as are Immediately neces- 
sary. The control signals through output 108 and inter- 
connection 106 will control various actuators, such as 
those located on wheels 72, 74. In case of discrepancy 

50 between two results so calculated by both processor 
units 76, 84, the actuation signals to peripheral control 
unit 96 are deactivated, for example in that the automat- 
ic braking facility is suspended. Moreover, such situation 
is immediately signalled on warning device 97. Finally, 

55 if persisting, the dangerous situation could lead to such 
actions as effectively stopping the vehicle in a safe po- 
sition. 

[0028] Figures 7a, 7b illustrate two functional ar- 
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rangements regarding the execution of the signal vali- 
dation. In both Figures, the following Items correspond. 
[0029] In Figure 7a, signal source 20/26, cf. Figures 
3-5, will receive the various sensing values. These sig- 
nals are forwarded to main processing unit 28 and/or 
security related processor 30, as shown. On the basis 
thereof, both main processing unit and secondary 
processing unit execute respective security-related 
processing. In Figure 7a, all first secondary security-re- 
lated data are sent to checking element 80. Further- 
more, also secondary security data from secondary 
processing unit 30 are sent to checking element 80. The 
check is executed between the second security-related 
values and a selection from the first security related val- 
ues. If the check is positive, all data received from 
processing unit 28 in element B0, will be transferred to 
output 34 for subsequent use. 
[0030] In Figure 7b, ail first security-related values are 
sent to gating unit 84, and only a selection therefrom is 
sent to check unit 82. if the check is positive, gate unit 
84 will be opened; if negative, it will be blocked, in both 
Figures, the multi-media processing operations and as- 
sociated result data have been left our of consideration. 
Note that the latter could share physical transfer chan- 
nels, so that the inputs and outputs of the security-relat- 
ed data are logical channels. 

[0031] In the above, the present invention has been 
described with reference to a disclosure and drawings 
that illustrate a preferred embodiment. Persons skilled 
in the art would however from inspecting thereof recog- 
nize various changes and amendments to such pre- 
ferred embodiment. Therefore, the disclosure herein 
should be considered by way of example, ratherthan by 
way of restriction, and the due scope of the present in- 
vention should be determined from the Claims append- 
ed hereto. 



Claims 

1 . A multimedia and telematic system including a nav- 
igation system for a motor vehicle and comprising 
sensor means (20-26) for sensing one or more en- 
vironmental and/or vehicle-associated parameter 
values, processing (28, 30) means fed by said sen- 
sor means and including data and program storage 
facilities, presentation means (32) fed by said 
processing means (26) for presenting various mul- 
timedia-based results to an operator, and actuator 
signal output means (34) fed by said processing 
means (28, 30) for outputting one or more actuator 
control signals for controlling one or more associat- 
ed safety-related devices, said system being char- 
acterized In that said processing means comprise 
a main processor unit (28) for executing multimedia 
and navigation calculations and furthermore first 
security-related calculations, and said system com- 
prises furthermore a secondary processor unit (30) 



for executing second security-related calculations, 
wherein said main processor unit (28) has a first 
output (32) for outputting multi-media result data 
and a second output (36) for outputting first securi- 

5 ty-re!ated result data and In that the secondary 
processor has a third output for outputting second 
security-related result data, wherein said process- 
ing means furthermore comprise validation means 
(80, 82) fed by said first and second critical result 

10 data for on the basis thereof selectively enabling a 
further output (34) for outputting results based on 
said first security-related calculations. 

2. A multimedia and telematic system as claimed in 
15 Claim 1 . characterized in that said main (28) and 

secondary (30) processor units receive identical 
sets of sensor signals. 

3. A multimedia and telematic system as claimed in 
20 Claim 1 , characterized in that said main (28) and 

secondary (30) processor units receive mutually ex- 
clusive sets of sensor signals. 

4. A multimedia and telematic system as claimed in 
25 Claim 1 , characterized In that said main (28) and 

secondary (30) processor units are sharing a sub- 
set of the overall set of sensor signals. 

5. A multimedia and telematic system as claimed in 
30 Claim 1, characterized In that said secondary 

processor unit (30) recurrently calculates at least 
one critical security datum of a current speed and a 
current position of said motor vehicle. 

35 6. A multimedia and telematic system as claimed in 
Claim 5, characterized In that said secondary (30) 
processor unit calculates a particular critical secu- 
rity-related datum at a greater re-currency spacing 
than does said main (28) processor unit. 

40 

7. A multimedia and telematic system as claimed in 
Claim 5, characterized in that said secondary (30) 
processor unit calculates a particular critical secu- 
rity-related datum at a lower resolution than does 

45 said main (28) processor unit. 

8. A multimedia and telematic system as claimed in 
Claim 1 , characterized by effecting short-term val- 
idation at a different tolerance value from long term 

so validation. 

9. A multimedia and telematic system as claimed in 
Claim t , characterized by a hysteresis facility for 
preventing jittered non-validation. 

55 

10. A navigation system arranged for use In a multime- 
dia and telematic system as daimed in Claim 1 . 
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11. A motor vehicle arranged wilh a navigation system 
or a multimedia and telematlc system as claimed In 
Claim 1 . 

12. A motor vehicle as claimed in Claim 11 , character- 
ized in that said validation means are operative on 
respective vehicle position values calculated by the 
main and secondary processing units, respectively. 
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